- Joined
- Feb 17, 2012
- Messages
- 1,552
- Reaction score
- 2,604
Hello players,
I have to release a new version now, as there is a security leak on older version that can be exploited.
Security
Note that passwords were never in danger (as they were never sent to anything besides star-made.org), it was only possible to reset the password on ones account. This has also already been fixed as you now require an old password to change your current, and you need an email confirmation to change your email. To reset your password (if you really have forgotten it), you have to be logged out. A "request new password" link will appear under the login block.
The breach was possible due to session hijacking. Fortunately no damage was done, and it has been fixed 100%.
Since there is no point in security through obfuscation, this is how it works:
1. client logs into star-made.org
2. clients creates a code and sets it on his account (only possible when logged in)
3. client logs into server and supplies the code he set
4. server can request the current code for a client (but nothing else)
5. if code is the server is requested is the same as the client supplied, the client is who he says he is.
6. after logging in the client resets the code, so it's basically one time use only
This system will be replaced with a faster token system when the new website is ready.
Structure Tab
Please not that this is still work in progress, so it's not complete yet, and there might be bugs.
Thank you for playing StarMade,
- schema
I have to release a new version now, as there is a security leak on older version that can be exploited.
Security
Note that passwords were never in danger (as they were never sent to anything besides star-made.org), it was only possible to reset the password on ones account. This has also already been fixed as you now require an old password to change your current, and you need an email confirmation to change your email. To reset your password (if you really have forgotten it), you have to be logged out. A "request new password" link will appear under the login block.
The breach was possible due to session hijacking. Fortunately no damage was done, and it has been fixed 100%.
Since there is no point in security through obfuscation, this is how it works:
1. client logs into star-made.org
2. clients creates a code and sets it on his account (only possible when logged in)
3. client logs into server and supplies the code he set
4. server can request the current code for a client (but nothing else)
5. if code is the server is requested is the same as the client supplied, the client is who he says he is.
6. after logging in the client resets the code, so it's basically one time use only
This system will be replaced with a faster token system when the new website is ready.
Structure Tab
Please not that this is still work in progress, so it's not complete yet, and there might be bugs.
Thank you for playing StarMade,
- schema
